The campaign included the use of a variant of AZORult, an information-stealing malware; as well as the RAT Remcos; the DarkVNC backdoor trojan; and a clipboard cryptocurrency stealer.
DarkVNC
DarkVNC is a Windows hidden virtual network computing (hVNC) remote-access trojan that creates a concealed virtual desktop on an infected system, enabling an operator to view and control that desktop through VNC technology without exposing the activity on the victim’s visible desktop.
Profile source: Mallory opens in a new tabDarkVNC
Family profile
DarkVNC is a Windows hidden virtual network computing (hVNC) remote-access trojan that creates a concealed virtual desktop on an infected system, enabling an operator to view and control that desktop through VNC technology without exposing the activity on the victim’s visible desktop. It has been used to remotely control compromised computers and transfer stolen victim data to command-and-control infrastructure. DarkVNC has been distributed by IcedID and has also been observed as a payload wrapped by the TrickGate packing service. A 2016–2017 campaign alleged by U.S. prosecutors used fraudulent accounts on a freelance-employment platform to send malicious Excel attachments; victims who enabled embedded macros downloaded DarkVNC or TVRAT. The campaign allegedly targeted freelance-platform users at scale and used compromised-system access and stolen data to support fraud. DarkVNC should not be conflated with LOBSHOT or Anubis VNC merely because of hVNC functionality, VNC traffic, or possible shared code.
Capabilities
- Exfiltration
- Post Exploitation
Reported operators
Threat actors
3 named in public reportingMITRE ATT&CK
DarkVNC in ATT&CK
20 distinct techniquesTechniques
20 techniques T1204.002 Malicious File T1041 Exfiltration Over C2 Channel T1219 Remote Access Tools T1059.005 Visual Basic T1105 Ingress Tool Transfer T1566.001 Spearphishing Attachment T1566.003 Spearphishing via Service T1071.001 Web Protocols T1203 Exploitation for Client Execution T1657 Financial Theft T1213 Data from Information Repositories T1071 Application Layer Protocol T1059.001 PowerShell T1566.002 Spearphishing Link T1021.005 VNC T1053 Scheduled Task/Job T1055 Process Injection T1027 Obfuscated Files or Information T1566 Phishing T1202 Indirect Command Execution
Reporting
Research mentioning DarkVNC
May 4
Elastic Security Labs
Unpacking ICEDID | Elastic Security Labs
Elastic Security Labs documented how to unpack ICEDID’s fake-GZip variant, a credential- and banking-information-stealing malware family that uses custom file formats and encryption to impede analysis. The examined sample contained an encrypted configuration, core binary, and persistence loader; recovered configuration data identified alishaskainz[.]com and villageskaier[.]com as C2 domains and /news/ as the beacon URI. The workflow reconstructs ICEDID custom PE files, including x64 and x86 browser-hook payloads, for static analysis; execution should be limited to isolated environments. Separately, Malpedia published an autogenerated YARA signature for Windows DarkVNC. The rule evaluates ten byte-pattern sequences and matches files below 606,208 bytes when at least seven patterns are present, providing a detection option for the remote-access malware family. The reference does not attribute DarkVNC to a specific incident, campaign, or threat actor.
Aug 12
Malpedia
